Sony has informed consumers who have used the PlayStation Network that much of their personal information has been stolen by a person or group of people who broke into the system and made off with the data. What Sony can't (or won't) tell us is whether our credit card information remains secure.
The number of Ars Technica readers who have had issues with their credit cards in the past few days, and have commented, e-mailed, or Tweeted about the issue, is alarming. We may be dealing with a coincidence in timing, but when your inbox is heavy with people saying they're fighting fraudulent credit card charges, it may be the first signs of fire somewhere in the smoke.
What people are saying
Let's take a look at some of the comments and e-mails that have been sent to us. Some people are just now noticing the issues, while others noticed the fraudulent charges last weekend.
"My American Express card was compromised over the weekend," one commenter stated. "This card sits in a drawer in my house for emergencies, but I did use it once on my PSP for an account. Luckily American Express is very good at notifying me immediately after the first fraudulent purchase."
Another reader e-mailed with a similar story. "About two or three days ago, my bank notified me that I had gotten my own [credit card information] stolen, the one I use for my PSN account, and with it a ticket was purchased through a German airline for nearly $600," she told Ars. "They are still looking into the fraud charge meaning that right now I have a negative $500 in my account, with no good chance that I'll be getting that back any time soon."
Another reader had a similar issue. "I had a call from my credit card company trying to verify a purchase which ended up being fraudulent. Same card I use on Sony's network. They denied [the charge] and issued me a new card," the reader commented. "Might be coincidence, but with the other security gaffes recently, I'm guessing not. Not sure what my opinion of Sony is right now and what my future is with them."
Let's keep this ball rolling! "I also had an attempted fraudulent charge on my American Express card, about $8,000 going to some Japanese store. This all happened about when PSN started having trouble, so I'm betting this had something to do with it," another commenter said. "My advice: if you have your credit card info on PSN, watch your accounts like a hawk. I'm buying pre-paid cards from now on; you know, if I decide to ever spend money on PSN again."
Here's a response to a complaint of fraudulent charges in the comments. "Probably not a coincidence, I had the same thing happen this weekend. I got an Easter Sunday call from American Express about suspicious charges that began Saturday."
There are more, but they're all variations on a theme. All told, two dozen or so people have contacted Ars with reports of fraudulent or suspicious activity on their credit cards. It's still possible that this story simply caused people to take a look at their finances and find unrelated issues, but in many of the reports the credit card companies are reaching out to them with reports of abuse.
What can you do?
We contacted Sony for comment, but we're not holding our breath: the company has been famously reluctant to share information with angry gamers demanding disclosure. While the PlayStation Network remains down, you can do a search for past e-mails from Sony, sent when you've added funds to your account; this will tell you what credit card you have on file—and that's the card you need to be concerned about.
Be sure to watch your accounts, search for any suspicious activity, and you can contact your bank and ask for a replacement card. Call your financial institutions about fraud protection services, but be sure to research any for-pay solutions.
If you have had issues with your credit card since the PlayStation hack, let us know in the comments. The sooner we receive official word from Sony, the better for everyone.
Update: Sony has announced the following about the credit card data:
All of the data was protected, and access was restricted both physically and through the perimeter and security of the network. The entire credit card table was encrypted and we have no evidence that credit card data was taken. The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack.
reader comments
237